I have a list of login events on the index which has the following fields.
ip_address: <text> login_success: <bool>
Now I want to query the logs and get a count of number of success and failed logins from each IP address. Example output should look like the following
ip_address: 188.8.131.52 login_count: 45 failed_login: 50 ip_address: 184.108.40.206 login_count: 10 failed_login: 20
As you can see, there are totally 95 events from the IP address, 220.127.116.11 of which, 45 are success and 50 are failures. I can do a simple term aggregation to get the number 95 but I am not able to aggregate on success and failure separately. is there a way to achieve that in ES?
Let me know if I am not clear in my question. Thanks!